Subject: [Lawrence Greenfield <[email-masked]>] Re: Concerns about GSSAP service names

From: Sam Hartman <[email-masked]>
Date: Fri, 31 May 2002 16:37:49 -0400

Edited slightly for clarity from the original discussion.  I agree
that advice on keying would be useful but do not believe we understand
what advice to give for clarifications.

If people find this acceptable I'll give Cliff text.

Subject: Re: Concerns about GSSAP service names
From: Lawrence Greenfield <[email-masked]>
To: Sam Hartman <[email-masked]>
Cc: [email-masked]
Date: Mon, 22 Apr 2002 14:35:52 -0400

Hi Sam,

   But first I'd like to make sure I understand the problem I'm solving:

   * Some implementations do DNS canonicalization, some do not.

Correct.

   * DNS canonicalization is insecure.

Correct.

   * Some implementations downcase the result, some do not.

Correct.

   Are there any other issues with GSS service names?

"DNS canonicalization" isn't a sufficient specification.  It turns out
that our krb4 library does DNS canonicalization only by doing a
forward lookup (expanding CNAMEs) while other Kerberos implementations
do a full forward lookup followed by a full reverse lookup.

In fact, last week I discovered that the problem is even trickier than
I realized.  On Solaris, really weird things can happen.

On Linux:
% host mail-fe2.andrew.cmu.edu
mail-fe2.andrew.cmu.edu has address 128.2.10.172
% host 128.2.10.172
172.10.2.128.in-addr.arpa domain name pointer cyrus-test.andrew.cmu.edu.
% host cyrus-test.andrew.cmu.edu
cyrus-test.andrew.cmu.edu has address 128.2.10.173
% 

On Solaris, using gethostbyaddr() on 128.2.10.172 would fail
completely since it resolves to a hostname that doesn't go forward
to 128.2.10.172.

So basically, unless implementators are extremely careful and the
specification is very detailed, using DNS can lead to a lot of
different interpretations.

[Proposed solution]

   - Specify that Kerberos implementations MUST NOT do DNS expansion
     on principal name components.
   - RECOMMEND that applications pass to Kerberos, GSSAPI, or SASL only
     unmodified hostnames as entered by the user, with the possible exception
     of case-folding.
   - Implementation note saying that for existing GSSAPI implementations,
     wrong things may happen if you pass in an uppercase hostname or one that
     is not fully qualified.  Solution is for the app to downcase before
     passing the name to GSSAPI but _not_ DNS-expand, and for users to type
     fqdn's or accept that sometimes they will lose (if the GSS implementation
     doesn't qualify) or get something insecure (if it does).
     Maybe we can also say that such apps MAY append a fixed domain name to
     unqualified hostnames, since apps that do that will make a lot of users
     happy without any real security implications

Yes, I think this is an excellent start.  Some guidance on how
administrators are suppose to key machines would probably also be
helpful (especially as software starts automating the key management
more and more, a la win2k).

thanks,
Larry